Re: Using the --verify option on cpanm

--Sig_/dci7DIVEur0b4U0ZbZSni4+
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

> It sounds
> like it means that the signature will be checked only if it is
> present. If the --verify option is used and the signature is missing,
> will the package be downloaded and installed nonetheless?
Yes, and it works the same as the traditional CPAN client with signature
support enabled. Most distributions are not signed because it's an
optional feature. All distributions are checksummed by PAUSE.

> How does one obtain the public key that is used to check
> these signatures? Is it installed along with cpanm?
cpanminus just delegates to Module::Signature::_verify. This fetches the
public key via [HKP](http://enwp.org/OpenPGP_HTTP_Keyserver_Protocol).

--Sig_/dci7DIVEur0b4U0ZbZSni4+
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCgAGBQJTyHHrAAoJEO5ZBCSkxNcgPkcQALfvptb4lUJQs6N++KdfJE86
ipNLfeDiE60Vde/6B1QZ7EUT+WHySnvuguCONIheMDWym7pdMadoPknhdpZcQcsT
LPwWrN0ByF9ln0wwEPq2bwSxXkhZyQu7XIida5+a+torZWjjc+bVAA1s8OYmuwXh
sUQYvjajqt0e0tMwcv+iv5xOtlfooHGpOERd0EmTVLExyv3SXqW+bsMS3cYiVnmI
hCD3d7ucQla1QioBMpdN+B+RRMdwMrTBMHQtFwk+uiGh4pqRXqX1RAbaQVU0lQOc
m4YztdqoPvmRawH0QsG53SkJo17c2xH/nNa8gIYF2D3Zuw4pjJH+4/WYdcBnAKUg
9pvpwt59oIELuRnAufTpu+NtI/oXqmNB7drbaXNpy5NQu46DBI3c845QuhFhkBEn
iDr4oS9zLQhAdBNrBhgwkKEiI2pogB412UT+zRLoJ2XT3deX9Ug36mN3zpPyblio
irhBBxQ/gcHp8LxB5zf/NzYByKq4Sa2TkFSTdpRbNcSGyBVWRxy9fPhBMcGFr0Aq
3AZ8a33w8r7D9E4Ht3rDPA9zQNZdDq3uvEGTb33wH9xAtXdmVOrwWlz86v4GGffG
T4RG15QIdpTq9EFfPQLxlgpB1e9DNhhTNl6qSXmlsyqugtx1jh/uo5I4OQanW1+n
BW9WH7QO6QnyIPjEHUrM
=StrN
-----END PGP SIGNATURE-----

--Sig_/dci7DIVEur0b4U0ZbZSni4+--